使用php插入mysql

Question

I am working with php and mysql for the first time. The goal is to have a table that store email addresses to form a mailing list for a newsletter. my table Emails has 2 columns ID (INT auto increment) and email (varchar, 255)

I can connect to the database but I cannot write to it. I think my problem is in the syntax of my INSERT INTO statement. I have seen many examples and they seem to use different syntax specifically around the values. form code:

    <form method="post" action="email.php" class="form-container">
    <div class="form-title"><h2>Sign up for my newsletter!</h2></div>
    <div class="form-title">Email Address</div>
    <input class="form-field" required="required" placeholder="[e-mail]" type="text" name="newEmail" /><br />
    <div class="submit-container">
    <input class="submit-button" type="submit" value="Submit" /></div>
  </form>

php code:

    <?php
    $dbHost = "localhost";
    $dbUser = "input";
    $dbPass = "input";
    $dbName = "MailingList";


$conn= mysqli_connect ($dbHost, $dbUser, $dbPass, $dbName);

if(mysqli_connect_errno()) {
die("FAIL:". mysqli_connect_error() . "(" . mysqli_connect_errno() . ")");
}

$addEmail = "mysqli_real_escape_string($_POST['newEmail'])";

$query ="INSERT INTO Emails (email) VALUES ('$addEmail')"

mysqli_close($conn)
?>

Answer 1

You need to execute the query, not just write it.

$query ="INSERT INTO Emails (email) VALUES ('$addEmail')";
mysqli_query($conn, $query);

If you use a prepared statement, you can save yourself the trouble of escaping:

$stmt = mysqli_prepare($conn, "INSERT INTO Emails (email) VALUES (?)");
mysqli_stmt_bind_param($stmt, "s", $_POST['newEmail']);
mysqli_stmt_execute($stmt);

---

If you want non-procedural style (aka oop), this would look like the following

$stmt = $conn->prepare("INSERT INTO Emails (email) VALUES (?)");
$stmt->bind_param("s", $_POST['newEmail']);
$stmt->execute();